Joomla! Tools Suite v1.0 & Health, Installation and Security Audit Tool

[guysmiley]

Russ,

On behalf of all of us who are security-challenged, thank you.  I look forward to seeing this component in full-bloom!

My 2 cents:
  - if there was a feature that was designed to indicate if an upgrade to a 3rd party component/bot/mod was available that would be amazing (I don't know how this is possible, but maybe you could start a trend since your component seems to be the inaugural security centre for Joomla - perhaps joomlacode could put out an rss-type message when a new version of an extension comes available that's picked up by JTS?)!
- also, a list of which directories ought to be writable would be fabulous.  To my knowledge, just images/stories & cache/ should do it, but I'm still not certain...

THANKS, OZZIE RUSS!  May the roos of down-unda smile apon ya! (that was remarkably cheezy... forgive my Canadian, polar bear-based humor.  It's so cold here, we don't get out much).

[deafbiz]

This is one component I would gladly pay for!

It would be a DREAM if it sends a notification message if there's a C/M/P update available! That ought to cut down the number of hacking incidents.

[kiwidesign]

Yeah this is definitely something I would love to see - When you have a few sites its hard to maintain them all and if you could get notification (via email would be AWESOME) that a c/m/p needed an update it would be great.

Kiwidesign

[RussW]

OK, OK    I suppose I should have seen that one coming....... 

I will look in to the C/M/P updates, BUT....  (really bug but....)  Really don't hold your breath for this one......

Due to there being no one central place to reference revision changes, and maintaining such a database yourself would not really be feasible, it is unlikely to be available, but I will keep working towards that goal.....

The writable directories question is always a "contentious" issue... This is so dependent on the host configuration,  HISA already does some checking and deliberating, but I will see if I can make it more "end user-friendly"

Thanks for your support and comments, we will continue to work on the component and see how things go, will let you know when there is something (Alpha) to try out.......

[guysmiley]

Russ, you rock out.

I was thinking that if there was an additional field (i.e. updated date) put into joomlacode, it could check against that field in HISA.  This, of course, requires the joomla project guys to create his field but I think it would be well worth it!!! 

Actually, come to think of it, those dates are already there in a field, aren't they?  Can you create some wicked code that cross-references the 3rd party coms published dates against those available on joomlacode?  Not that you have a life and anything better to do...  like surfing or catching wallabies.

[RussW]

Joomla! Tools Suite component v1.0.0.A (Alpha Release)
[edit1] Still for Joomla! v1.0 Only! English Language Only! and only test on v1.0.13 to date...
[edit2] Hey, kewl and I made my 3,500th post announcing the Alpha release.......

JTSc installs as any other Joomla! component, several little extra's compared with the StandAlone JTS Edition, however it is currently feature incomplete.

I have tested it on PHP4.4.4 & PHP5.3.2, MySQL 4 & 5 on both WAMP and LAMP, all seems ok to me

Due to time constraints over the coming weeks, this is likely to be the only release for a few weeks, but I thought you might like to have a look and play with it before we move forward.


                        IMPORTANT NOTE
  ********************************************
  ** This is a "Test and Development" Alpha Release.  **
  **          Not for Production Environment Use          **
  ********************************************
  **        Download JTSc v1.0.0A (Alpha Release)      **
  ********************************************

- Thoughts, idea's, comments and discussion always welcome.
- Bugs and WishLists to the trackers on JoomlaCode please.
  Remember the time pressures, I might not get to answer them for a few weeks though.

[Tokapi]

Actually, come to think of it, those dates are already there in a field, aren't they?

The date won't be a good check, because it changes on every manipulation on the project (even adding a new message).

[guysmiley]

Hmmm...  No date field.

I suppose, in theory, it could keep track of the number of files in the database, and, when x+1 occurs, it notifies admin.

Am I crazy?

[RussW]

OK folks.....

I have just refreshed the JTS Component ( com_jts ) file-set on JoomlaCode.

Please re-download here..... or visit the JTS Project page on JoomlaCode.


Additions & Updates 18th September 2007

•  
• WebUI graphical enhancements...
   
• Messaging enhancements
    tried to follow more international recognised colours (traffic light/robot colours) + icons
  - Red    : Critical/Error
  - Amber : Warnings
  - Green  : Success Good
  - Purple  : Advisroies
  - Teal    : Informational
   
• Added "Two-Step" menu...
  - "Joomla! Tools Suite" Main-Menu item : Runs the normal JTS Tool Set
  - "with Server Services" Sub-Menu item : Runs the normal JTS Tool Set but includes Server Services Port checks (POP, SMTP etc..)
    JTS loads slower with this option, whilst it checks port status
   
• Added "Security Lock" icon designation
  - Coloured : Security Best Practice Advice
  - Faded : Potential Security Risk Notification
   
• Added new checks for "Default Admin" account name not being changed
   
• Added additional checks for
  - .htaccess being present in Joomla! "/"
  - .htaccess being present in Joomla! "administrator/"
  - SEO enabled w/o .htaccess
  - Debug Site enabled
  - configuration.php being writable
  - incorrect $mosConfig_absolute_path
  - Cache enabled, cache directory not writable
   
• Heaps of new messages, including Joomla! Help and Forum links
   
• An About Page with links to JoomlaCode

[AmyStephen]

Good grief, this is simply amazing, Russ. This tool sets Joomla! apart by helping community members get their arms around the platform issues. It is as relevant for J! as it is for any PHP-based tool. Truly unique in the open source landscape, though. I have *not* seen anything similar.

We are having problems with several installs for J! v 1.5 where they get a blank frontpage, but the backend administrator works. I want to say - get Russ's tool and plug it in, because I know this tool highlights the issues that must be considered. (That wasn't intended as pressure. It was merely a comment to show you how, for me, it's become a necessary part of the install process.)

You are sharing your valuable system administrator knowledge freely. Thanks, Russ, for this major contribution.
Amy

PS - that was a pretty cool 3,500th post! 

[RussW]

Thanks for the kind words Amy, it's early days yet, but I think it is beginning to shaping up reasonably well.... 

Unfortunately, the v1.5 HISA, JTS and JTSc may be awhile, I need to get myself up to speed with MVC and all the rest of the good stuff yet (not a PHP coder by trade) , still really learning my around J!1.0 backend framework at the moment

There are a few differences, but not too many for J!1.5 in the checks and things, just getting it to reside outside of J! but work is really the only thing that needs attention for the StandAlone tools. The component will be a little longer I think.

It's all on the list to do, but the component plan kind of came to the top of the list and has stayed there right now....

[AmyStephen]

Eventually, it will *all* get there. Meanwhile, it's good to strengthen the 1.0.x platform, as you are doing. Until the extensions are in place, most sites will be there.

Thanks, again!
Amy

[RussW]

@Amy

For those with kind words and patience, good things happen.......... ( Well hopefully... )

Available for immediate download........

    Joomla! Tools Suite Component (JTSc) v1.0.0B
   

    Now supporting;
    - Joomla! v1.0.11 through v1.0.13
    - Joomla! V1.5.0 in Legacy Mode 

Additions and Updates;

•  
• Minor WebUI enhancements
   
• Minor bug fixes
   
• Additional Messaging
  - Additional v1.0 messages
  - New v1.5 messages
   
• Restricted Access
  - Super Administrator access Only
   
• Additional Server Statistics
  - Checks for potentially unwanted active Ports
    (Currently 6666 & 6667 - IRC)
   
• Included "Free Disk", "Total Disk", "Free Memory", "Memory Used"
    (on hosts that support the functions)

I have tested on v1.5-RC2 and a rather old SVN release, still not tested on v1.0.11, 1.0.12 fully, but nothing effecting JTS/HISA should have changed there compared to 1.0.13...

Let me know if I have missed anything obvious for v1.5 Auditing, or if I have missed limiting the messaging and any v1.0 only messages present themselves with v1.5 (or visa-versa) I am sure I would have have missed something.....

Hopefully, it is useful and works well enough for its purpose on v1.5.0, enjoy......

[AmyStephen]

Available for immediate download........

    Joomla! Tools Suite Component (JTSc) v1.0.0B
   

    Now supporting;
    - Joomla! v1.0.11 through v1.0.13
  - Joomla! V1.5.0 in Legacy Mode 

WOW!! 

I'll give it a go! I tried it with 13 yesterday and LOVED it. Thanks again!
Amy 

[Markku]

Hi Russ (long time no speak)

Great work again!

I'll provide you the language files shortly.

[vdrover]

Very nice tool set.

Cheers!

[RussW]

@markku
Thanks for the offer, and yes, it has been a long while, hoping all is well with you.  I still need to put this in SVN for you guys, will try and get it done later today.

Don't let me put off, but if you want to hold off with the translation, when I clean the whole thing up I will add a language option like the original JTS instead of as it is now with everything in the admin html page, that should make the translation easier to do and to maintain in the future.

This is still Beta, so there is more to do and add and I wouldn't want to keep making changes that require continuous updates from yourself, eating in to your time.

@Amy, vdrover
Thanks for the comments, hopefully it works well for end-users.

Not quite as slick as JCal Pro though And please do remember, it is Beta, I am not a Pro Developer so the code still needs massive cleaning up and optimising, it is really rough at the moment, but works and as far as I have tested, secure and reasonably accurate.

[Markku]

Hi Russ, thanks for your advice, so for now I will hold off with the translation.

[RussW]

Joomla! Tools Suite SnapShot Administrator Module v1.0.0B (Beta Release)

                        IMPORTANT NOTE
  ********************************************
  **                  This is a Beta Release.                    **
  **          Not for Production Environment Use          **
  ********************************************
  **    Download From The JoomlaCode Project Site  **
  **              Joomla! Tools Suite SnapShot              **
  **          Control Panel Administrator Module            **
  ********************************************

JTSsnap Administrator Module installs as any other Joomla! module, it is assigned to the "Administrator Modules" group (so you will need to go to Administrator Modules to configure it...). Once installed,  Publish/Enable to the cpanel position four configuration options are available;

•  
• Security Checks
   
• Joomla! Checks
   
• Configuration Checks
   
• System Checks

If the JTSc (component) is installed, JTSsnap will display the last JTSc Assessment Rating...  Place your mouse over the desired category icon to display check information.


JTSsnap supports;

•  
• Joomla! v1.0.11 through v1.0.13
   
• Joomla! v1.5.0  (Legacy Mode)

I have tested it on PHP4.4.4 & PHP5.3.2, MySQL 4 & 5 on both WAMP and LAMP, all seems ok to me

Due to time constraints over the coming weeks, this is likely to be the only release for a few weeks, but I thought you might like to have a look and play with it before we move forward.

  - Thoughts, idea's, comments and discussion always welcome.
  - Bugs and WishLists to the trackers on JoomlaCode please.
   

[vdrover]

Now that is awesome!

[guysmiley]

Geez,

I thought you were an 'amator' programmer    Talk about a necessity!

[RussW]

Thanks folks,

OK, last one in the series, then its update and cleanup time for all releases.....

Just in-case anyone would actually like to either Promote Joomla! Tools Suite or display their JTSc Assessment Rating publicly...

Joomla! Tools Suite -assured is a Joomla! Site module, when published to your site the module displays your JTSc Assessment Rating if the rating is above 90%, for reasons of site integrity, if below 90% it is configurable to either display nothing or the JTS logo.

Pre-Configured or Custom Header and Text colouring is available in the Module parameters, along with a number of alternative setting for display to suit your site.

    Joomla! Version Support:
        - v1.0.11 through v1.0.13
        - v1.5.0 (Legacy Mode)


If JTSc is not installed, the module will simply display the JTS logo with a link to the JTS JoomlaCode Project page.  (A new parameter is needed so even if JTSc is installed, you can choose to still only Promote JTS and not display your JTSc Rating, will be there in the cleanup release)

  Download JTS-assured From JoomlaCode


So I think that is now the complete "Suite" of JTS, just need to cleanup the Extensions for a Final production release and update the StandAlone tools for J! v1.5.0......

Thanks for the support folks, much appreciated.........

[vdrover]

Joomla! Tools Suite -assured is a Joomla! Site module, when published to your site the module displays your JTSc Assessment Rating if the rating is above 90%, for reasons of site integrity, if below 90% it is configurable to either display nothing or the JTS logo.

I am not sure how I feel about this one. Advertising which components are installed on the frontend can be a bit of a security risk and also allow hackers to find your site based on component (this was common when the extcal security vulnerabilities were discovered, hackers just googled com_extcal to look for vistims).

[guysmiley]

Hmmm...

I was thinking along the same lines.

This kind of tag feels like a 'hacker safe' kind of promo tag...  I'm not quite sure as to the purpose.  Are you advertising that if a J! site is JTS 'official' then it is secure?

[RussW]

Understand your thoughts, and certainly agree with the principal, I suppose mainly it was an exercise in "could I" and I suppose I was thinking along th elines of the Hacker Safe tagging, but I have always considered JTS to be more a functionality tool, so it was a "Functionality Assured" type tag , more so than a "It's 100% Secure"  tag.....

It's there if anyone wants to use it,  but I certainly don't see it being the majority of downloads or installs,  as I said, probably more of an excercise for me.... 

[vdrover]

Exercise is always good

[RussW]

OK, folks, thught a bit more about the JTS-assured Site Module, based on your thoughts....

FRS on JoomlaCode has been refreshed with new options;

*Default*
JTS Promotional Mode is now to simply display the JTS Logo and a JoomlaCode Download Link, just a simple JTS Promotional module...

Other wise there is the alternative JTSc Rating Mode where the normal original display is in operation, displaying the sites JTSc Rating, if it is over 90% and only displaying Promotional Mode if under 90%.

Not really sure if anyone would want to Promote JTS on their sites or display their JTSc rating, but the option is now there, if they want to   and there was actually 11 downloads overnight of the module

The take-up has bene quite surprising to me actually;

  JTS-component  :  359 downloads since the last FRS refresh 36 hours ago  ( that's about 358 more than I expected )
  JTS-snap          :    71 downloads since the last FRS refresh 24 hours ago  ( and 69 more than I expected, I download it twice myself )

Not quite Joomla! or JCal Pro rates, but not bad for a couple of "in-the-rough" releases from an amateur.....

Thanks for your comments and support, always appreciated.......

[vdrover]

Please keep us posted on the download trends, looks like you're doing well (and I wouldn't compare Joomla and JCal in the same sentence ).

Don't forget to look at the views on extensions.joomla.org.

[RussW]

The JTS-c component has been refreshed on JoomlaCode today to include new features.
30th September: 15.18hr
FRS Refreshed, please re-download...
Fixed Module Audit to work in both J!1.0 & J!1.5

•  
• Directory Permissions Audit
    - Limited to files under 5MB (To reduce timeouts with large file repositories)
    - Colour Coded for Elevated Permissions (777)
    - OwnerShip, User and Group Information
      (Windows, numeric UiD/GiD Only / Unix, Alpha UserName and GroupName)
   
• Files Permissions Audit
    - Colour Coded for Elevated Permissions (777)
    - ReadOnly/Writeable to WebServer indication
    - OwnerShip, User and Group Information
      (Windows, numeric UiD/GiD Only / Unix, Alpha UserName and GroupName)
   
• Components Audit
    - Administrator and Site
   
• Modiles Audit
    - Administrator and Site

Available for download from the  JoomlaCode Project Site

In the Works :
Mambots/Plugins Audit, DataBase Optimisation, Diagnostic Integration, Custom Diagnostic Integration (Adams Joomla! Diagnostic for 1.0 and 1.5)

[guysmiley]

Again,

Unbelievable!  I guess the stats on your daily download exemplify these comments, but I'm most excited by your 'In the works' stuff )

Awesome job,
gs